devrites 3.2.27 → 4.0.0

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -1,45 +1,26 @@
 ---
 name: rite-build
-description: Build one approved vertical slice, then stop with evidence. Use when the next planned slice should be implemented. Not for multiple slices.
+description: Build the next approved vertical slice with evidence. HITL stops after one; explicit AFK may chain bounded green slices.
 argument-hint: "[slice number or name]"
 user-invocable: true
-required-agent-roles: devrites-slice-wright
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-build: one verified slice
 
-Build and prove one slice, then **stop**. **Read the active workspace first**; if none,
-tell the user to run `$rite-spec <feature>`.
+Build and prove one slice. HITL stops; a later user invocation starts the next.
+Explicit `.devrites/AFK` alone lets the controlling root chain pending slices,
+only under existing green-proof, cap, and pause rules. **Read the active workspace
+first**; if none, tell the user to run `$rite-spec <feature>`.
 
-This skill owns the gates and workspace. A fresh-context
-[`devrites-slice-wright`](.codex/agents/devrites-slice-wright.toml) writes source and tests.
-Run the readiness, slice-selection, and HITL checks; dispatch the wright; then run the
-doubt, fail-on-red, recording, and stop checks. See
+The root owns gates/workspace; a
+fresh-context [`devrites-slice-wright`](.codex/agents/devrites-slice-wright.toml)
+writes source and tests. Apply the readiness, selection, host, HITL/AFK,
+dispatch, doubt, fail-on-red, record, and stop checks. See
 [`reference/wright-dispatch.md`](reference/wright-dispatch.md).
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
-Read `.agents/skills/devrites-lib/reference/standards/core.md` first (workflow step 0). The
-following load on demand: **the wright reads them** (they are named in its contract) while it
-writes; read them yourself for the doubt/record gates:
+Read `.agents/skills/devrites-lib/reference/standards/core.md` first. The wright
+reads named on-demand rules while writing; root reads them for doubt/record gates:
 - `coding-style.md`: naming, function shape, guard clauses, comments, reuse-first.
 - `error-handling.md`: fail fast, no silent catches, fail closed.
 - `testing.md`: pyramid, behaviour over implementation, see-it-fail-first.
@@ -52,13 +33,14 @@ writes; read them yourself for the doubt/record gates:
 
 
 ## Operating rules
-- **One slice at a time. DO NOT** start the next slice without the user asking.
+- **One slice per wright dispatch.** Every wright returns after it. The controlling
+  root applies the mode rule above before another dispatch.
 - Evidence over confidence. Prefer existing conventions. Feature scope only: no
   drive-by refactors.
-- **Record adjacent issues; do not edit them.** An issue outside the captured
-  `.wright-allowlist` becomes an FYI follow-up in `decisions.md`. The slice summary states
+- **Record adjacent issues; do not edit them.** An issue outside the exact paths
+  stated in the dispatch task becomes an FYI follow-up in `decisions.md`. The slice summary states
   what it deliberately left alone ([`git-workflow.md`](../devrites-lib/reference/standards/git-workflow.md)
-  "Things I didn't touch"). The `devrites-engine reconcile` gate enforces this boundary.
+  "Things I didn't touch"). The root rejects a returned diff outside this boundary.
 - **Don't re-run an unchanged check.** The same build or test on unchanged code provides
   no new evidence. Re-verify after an edit.
 - Surface material assumptions. Do not introduce an unplanned dependency or second design
@@ -79,31 +61,24 @@ writes; read them yourself for the doubt/record gates:
   principle was broken**; a fresh violation is handled like any irreversible-risk item: a
   human-approved, scoped exception in the register or a stop, never folded into the slice. No
   `.devrites/principles.md` → none declared → nothing to honor.
-- **You never edit source: the wright is the only writer of code + tests.** You write only
-  `.devrites/` bookkeeping. On any red gate, doubt finding, or coverage gap your only remedies
-  are to continue the same wright under bounded `devrites-debug-recovery` (three total attempts
-  per root cause) or stop with the correctly classified blocker: never patch the code yourself
-  and never ask the human to authorize agent-owned repair work. The `devrites-engine reconcile`
-  gate enforces this against the root-owned pre-dispatch allowlist: any source file changed
-  outside that exact set is a hard STOP.
-- **Forge is manifest-owned, winner-takes-all.** For a fully typed `Forge: yes`
-  slice, follow [`reference/forge.md`](reference/forge.md): `forge plan` precedes
-  reconciliation; every candidate is bound to its isolated worktree and live worker;
-  the judge records one winner; normal reconciliation and proof pass before manifest-only
-  cleanup and the human report. Any stale/ineligible flag uses one serial wright before
-  Forge creates state.
+- **You never edit source.** You write only `.devrites/` bookkeeping. Follow the
+  host gate in `wright-dispatch.md` before every build or recovery dispatch. On a
+  supported host, the wright is the only writer of code and tests. Codex gives
+  the root workspace permission only so that native writer dispatch can execute;
+  never patch code from the root. Put the exact project-relative source/test path
+  list directly in the task, dispatch the exact `devrites-slice-wright`, then
+  compare `git diff --name-only` with those task paths. Any extra source file is
+  a hard STOP.
 
 ## Workflow
 
 Run the full execution contract in
 [`reference/phase-contract.md`](reference/phase-contract.md). It is not optional:
 it contains the gated one-slice workflow, including readiness, HITL/AFK handling,
-wright dispatch, forge, doubt, fail-on-red, record gates, and stop behavior.
+wright dispatch, doubt, fail-on-red, record gates, and stop behavior.
 
 ## Output
 
-Use the full output contract in [`reference/output.md`](reference/output.md).
-It preserves the progress-footer-first response shape, uses the shared completion
-reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)),
-and keeps the explicit stop after one slice.
+Use [`reference/output.md`](reference/output.md) and the shared
+[`reply contract`](../devrites-lib/reference/reply-contract.md). They keep the
+HITL stop, bounded AFK chaining, and no-automatic-`$rite-prove` boundary explicit.

package/pack/generated/codex/skills/rite-build/reference/afk-discipline.md

@@ -3,6 +3,11 @@
 AFK mode is active when `.devrites/AFK` exists. It lets `$rite-build` chain slices
 without per-slice user input. The rules below limit that unattended work.
 
+Load the shared
+[`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md#the-sentinel-devritesafk)
+contract for the sentinel schema, defaults, gate ceiling, and mutable-counter
+ownership. This file owns only Build's dispatch, charging, and red-path behavior.
+
 These rules follow established autonomous-coding loops, including Ralph Wiggum and
 Claude Code auto mode:
 
@@ -14,44 +19,41 @@ Claude Code auto mode:
 4. **Keep irreversible work manual.** Destructive work, auth boundaries, and public
    API breaks always pause regardless of the sentinel.
 
-## The sentinel file
-
-`.devrites/AFK` (presence = AFK). Optional YAML body:
-
-```yaml
-max_slices: 10                       # read-only INITIAL budget; seeds state.md on first AFK build
-notify: "ntfy.sh/my-topic"           # shell command run on awaiting_human transition
-allow_gates: [advisory, validating]  # gate severities AFK may auto-handle
-```
-
-`.devrites/AFK` is **read-only config**: never rewritten in place. `max_slices` is the
-initial budget; the mutable remaining count lives in `state.md` as `AFK slices remaining:
-<n>`, seeded from `max_slices` on the first AFK build and decremented by `devrites-engine tick-afk`
-(see "Iteration cap").
-
-Defaults when keys are omitted:
-- `max_slices`: unlimited (a missing cap is risky: see "Always cap iterations").
-- `notify`: none.
-- `allow_gates`: `[advisory]`.
-
-To disable AFK, delete the file. The next `$rite-build` runs in HITL.
-
 ## Iteration cap
 
-`$rite-build`'s **record step** (workflow step 6) decrements `state.md`'s `AFK slices
-remaining` by 1 each time a slice is marked `built`, by running
-`devrites-engine tick-afk <state.md path>`. The script reads the
-field, decrements, writes it back, prints the new value, and **exits `3` when it hits 0**.
-The cap is enforced by `devrites-engine tick-afk`, not by prose, when it exits 3:
+The controlling root owns the cap:
+
+1. **Before every dispatch**, re-read `.devrites/AFK`, `state.md`, and the
+   selected slice. A configured `max_slices` and any existing
+   `afk_slices_remaining` value, including its released bullet form, must each
+   be a decimal nonnegative integer. A missing
+   `state.md` or malformed configured value fails closed; an omitted cap is the
+   documented unlimited default only when no remaining counter exists. If the
+   effective remaining value is zero, stop before dispatching another slice.
+2. **After proof is green**, combine the pending → built record and budget
+   charge in one `state.md` rewrite. If the remaining field is absent, add
+   `afk_slices_remaining` to a cursor table or `AFK slices remaining` to a
+   legacy bullet cursor, seed it from `max_slices`, and write
+   `max_slices - 1`; otherwise preserve its spelling and write `remaining - 1`.
+   The counter is never below zero: a value that would go negative is an invariant failure and
+   stops. A missing `max_slices` means unlimited and no remaining field is
+   created.
+   A controlling orchestrator may pre-seed the remaining field from a validated
+   post-plan budget before the first dispatch; never increase or reinitialize an
+   existing value.
+3. **Charge exactly once after each green built slice.** A slice already marked
+   built is not charged again after retry, resume, or compaction. Re-read the
+   saved cursor; if it is zero, report the cap and stop before the next
+   dispatch.
+
+Use this stop message:
 
-- `$rite-build` treats exit 3 as a forced HITL stop:
-  ```
-  AFK cap reached. Raise `state.md` `AFK slices remaining` or remove the sentinel to continue.
-  ```
-- The workspace stays consistent: no half-built slice, no pending question.
+```
+AFK cap reached. Raise `state.md` `AFK slices remaining` or remove the sentinel to continue.
+```
 
-Step 0 re-derives the remaining budget from `state.md` (seeding it from `.devrites/AFK`
-`max_slices` on the first AFK build); `max_slices` itself is read-only and never rewritten.
+`max_slices` itself is read-only and never rewritten. No exit-code command
+enforces this policy.
 
 Choose a missing or large cap deliberately. Ralph's rule is 5-10 iterations for small
 tasks and 30-50 for larger ones. Do not use `unlimited` for work that has not completed

package/pack/generated/codex/skills/rite-build/reference/anti-patterns.md

@@ -1,37 +1,23 @@
 # rite-build: anti-patterns
 
-Load this when standing a non-trivial implementation decision, or when the
-agent feels reluctance toward stopping after one slice, applying TDD, or
-calling `devrites-doubt`.
+Load when a non-trivial decision stands or stopping, TDD, or doubt discipline
+feels inconvenient.
 
-Pack-wide rationalizations + red flags (incl. tests-later, defensive checks,
-generic AI naming, drive-by refactors): see
+Pack-wide rationalizations and red flags live in
 [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
 
 ## Phase-specific rationalizations
 
 | Excuse | Rebuttal |
 |---|---|
-| "Slices 1 and 2 are related; let me do both." | One slice, then stop. Full stop. The user asks for the next. |
+| "Slices 1 and 2 are related; let me do both." | HITL needs a later user invocation. Explicit `.devrites/AFK` may let the root chain only after green proof and cap/pause gates; each wright still returns after one. |
 | "It's faster to skip `devrites-doubt` for this small change." | Doubt is cheapest *before* the decision is standing. After is debugging. |
 
-## Forge ([forge.md](forge.md))
-
-| Excuse | Rebuttal |
-|---|---|
-| "This slice is hard. I'll forge it." | Hard ≠ forkable. Forge competes ≥2 *genuinely-different* approaches with no clear winner. One hard approach is single-path; building it K times wastes K× for one answer. |
-| "I'm not sure which approach is right, so let me compete them and decide." | Forge is for a real fork the plan couldn't settle, not for dodging a decision you can make now. Decide from the code/docs first; forge only when the alternatives are genuinely undecidable on paper. |
-| "Candidate A's data layer plus B's UI would be the best of both." | Don't hand-merge candidates: two authors in one tree is the incoherence the single-writer rule exists to prevent. Land one winner whole; graft a *specific* runner-up idea only by continuing the winning wright once. |
-| "The judge already scored these, so I can skip the post-return doubt." | The judge picks *between* candidates; it doesn't replace doubting the winner's standing decisions. Steps 4-7 run on the winner unchanged. |
-| "A fourth candidate might be even better." | K is capped at 3. A fourth rarely moves the winner and multiplies cost; if none of three is right, the plan is wrong: `$rite-plan repair`, don't add candidates. |
-
 ## Red Flags
 
-- About to start slice N+1 without the user asking.
+- About to start slice N+1 outside explicit AFK or before its green-proof/cap/pause gates.
 - Skipping `devrites-doubt` on a branching, boundary, data-model, auth, public-API, or migration decision.
 - Adding a dependency or a second design system without recording rationale in `decisions.md`.
 - Writing a `try/catch` block wider than what you handle.
 - A comment that restates what the next line does.
 - Touching files that aren't in `touched-files.md` for "tidiness".
-- Forging a slice with no acceptance / `test-plan.md` coverage for the judge to score against.
-- Landing more than one candidate's code, or keeping a losing worktree/branch around after F7.

package/pack/generated/codex/skills/rite-build/reference/checkpoint-protocol.md

@@ -44,7 +44,8 @@ and the resume line is `$rite-resolve <qid> "<answer>"` (or `--drop <qid> "<reas
 
 ### Workspace mutations
 
-In one atomic write (one `state.md` rewrite + one `questions.md` append):
+In one bounded root-owned update (one `questions.md` append and one `state.md`
+rewrite; do not claim cross-file atomicity):
 
 1. **`questions.md` append:**
 
@@ -99,11 +100,12 @@ In one atomic write (one `state.md` rewrite + one `questions.md` append):
 ## qid generation
 
 Format: `q-YYYY-MM-DD-NNN`, where `NNN` is the next sequential integer for that date in
-`questions.md`. For the write side, call
-`devrites-engine resolve next-qid <questions.md path>`. It
-counts existing `## q-YYYY-MM-DD-` headers for today, prints the next zero-padded id, and
-refuses to print an id whose header already exists. Use that id verbatim so each qid is
-unique within the date.
+`questions.md`. The controlling root must scan every question header matching
+today's prefix, collect its numeric suffixes, and select one above the highest
+observed suffix (or `001` when none exist), advancing until it is unused. Then
+re-read `questions.md` immediately before the append and repeat the scan. Append only if
+the same candidate is still the next unused id; otherwise recompute. There is no
+reservation or engine command for qids.
 
 ## When AFK is active
 
@@ -123,9 +125,8 @@ If `.devrites/AFK` exists and the slice's `Gate` is in `allow_gates`, `$rite-bui
 For gates in `allow_gates`, AFK **auto-picks the recommended option** (option 1 of the set)
 instead of pausing, recording it as above. For `blocking` and `escalating` (and every
 irreversible-risk item), AFK **always** invokes the checkpoint protocol: the sentinel does
-not unlock these gates: **unless `allow_irreversible: true`** is set, which makes AFK
-auto-pick the recommendation on *every* gate, irreversible included (maximal autonomy, opt-in;
-see `afk-hitl.md`). See `afk-discipline.md` for the irreversible-risk list.
+not unlock these gates and no AFK key can override them. See `afk-discipline.md`
+for the irreversible-risk list.
 
 ## Multi-question pauses
 

package/pack/generated/codex/skills/rite-build/reference/checkpoint.md

@@ -1,21 +1,19 @@
 # Checkpoint: crash-survivable WIP commits (opt-in)
 
-`.devrites/` markdown survives compaction, but a slice's *source* stays uncommitted until
-`$rite-ship`. A crash or killed session mid-build: the AFK / `$rite-autocomplete` case:
-loses that source **and** the reasoning behind it. Checkpoint mode commits each proven
-slice as a local `WIP`, so the work and its context outlive the session.
+`.devrites/` markdown survives compaction, but a slice's source normally stays
+uncommitted until `$rite-ship`. A crash during unattended Build can lose that source.
+Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
 
 ## When it's on
-Opt-in via the `.devrites/CHECKPOINT` sentinel: the mirror of `.devrites/AFK`. Absent →
-no checkpoints; `$rite-build` behaves exactly as before. A long unattended run
-(`$rite-autocomplete`) is the case it earns its keep, so that path sets the sentinel for
-the run. **Local-only by rule:** a checkpoint is never pushed: scratch work must not
-trigger CI.
+Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
+`$rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
+**Local-only:** never push a checkpoint or let scratch work trigger CI.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
-A checkpoint records a **proven** slice; it fires only after PROVE is green, never on a red
-gate. Stage only the slice's `touched-files.md`, then commit locally with a
-`[devrites-context]` body a cold reader can restore from:
+A checkpoint records a **proven** slice only after its gates are green. Stage the exact
+slice-owned candidate paths from the manifest, passing each literal path separately.
+Never stage `touched-files.md`, a directory, glob, unrelated path, or user change.
+Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
 [ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
@@ -29,10 +27,9 @@ BODY
 ```
 
 ## Restore
-The commit body is a durable record, not just a marker. After a crash, a fresh session:
-or `$rite-status`: reads the last `WIP(<slug>)` body to reconstruct the decisions,
-remaining slices, and dead-ends that in-session `.devrites/` state would have held. No
-special tooling: it's a git log entry any agent can read.
+After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
+Authoritative state remains in `.devrites/`: validate the body against that workspace;
+never reconstruct, overwrite, or advance state from the commit body alone.
 
 ## Collapse at ship
 WIP commits are scratch and never reach shared history. `$rite-ship` folds them into the
@@ -41,4 +38,7 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 stays green.
 
 ## Autocomplete clean-baseline use
-`$rite-autocomplete` may arm checkpoint mode after it verifies a clean or explicitly accepted baseline. Checkpoints are local-only crash recovery, not authorization to continue across red gates or to ship. `$rite-build` remains one-slice-at-a-time; autocomplete is the only opt-in loop that may invoke multiple builds.
+`$rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
+They authorize neither red-gate continuation nor Ship. Each wright returns after one
+slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
+another green slice only under its cap and pause rules.

package/pack/generated/codex/skills/rite-build/reference/frontend-trigger.md

@@ -14,9 +14,9 @@ A slice is **frontend/UI** if it touches or plans to touch any of:
 - `$rite-spec` applies **`devrites-ux-shape`** (spec step 3a) to write the feature-level
   **`design-brief.md`** before any code: design direction, key states, interaction model,
   optional Figma/image visual-direction probe.
-- `$rite-build` applies **`devrites-frontend-craft`**, building **to** that `design-brief.md`
-  (register detection, refine the brief per slice, existing design system, all states,
-  anti-AI-slop) before/while implementing.
+- `$rite-build` applies **`devrites-frontend-craft`** to the vetted `design-brief.md`
+  (register, system, states, anti-AI-slop). If missing or materially changed, shape it
+  and return through `$rite-vet` before code.
 - `$rite-prove` applies **`devrites-browser-proof`** (proof ladder + evidence schema).
 - `$rite-polish` runs the full **normalize + polish** workflow.
 - `$rite-review` and `$rite-seal` include frontend UX / a11y / responsive / design-

package/pack/generated/codex/skills/rite-build/reference/one-slice-cycle.md

@@ -1,35 +1,32 @@
 # One-slice cycle
 
-The discipline that makes large features manageable: build one thin slice, leave it
-working and proven, stop. Never implement the whole feature in one pass.
+One wright dispatch builds one thin, proven slice. HITL stops; only explicit
+`.devrites/AFK` lets the controlling root chain another pending slice under the
+green-proof, cap, and pause rules. Each wright returns after exactly one slice.
 
 ## The cycle
 The orchestrator (`$rite-build`) gates and records; the **wright** writes. See
 [`wright-dispatch.md`](wright-dispatch.md).
 ```
 SELECT    → orchestrator: restate slice goal + acceptance + scope boundary; HITL gate (pause pre-code)
-(SHAPE)   → orchestrator: if UI and no design-brief.md, shape it (devrites-ux-shape) before dispatch
-(FORGE)   → orchestrator: if slice is Forge: yes, engine plan → snapshot → bound isolated
-            candidates → extract → judge → record + merge one winner, then continue at DOUBT (forge.md)
+(SHAPE)   → orchestrator: missing UI design-brief.md → shape it, then $rite-vet before dispatch
 DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context). Inside the wright:
    ORIENT    → load only the files this slice touches; learn the project's idiom; reuse-first
    (RED)     → if behavior change: write the failing test first
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
    VERIFY    → writer-safe tests/types/lint; return code + tests
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
-PROVE     → root: exact required production build/browser/E2E, then final reconcile; fail-on-red
-RECORD    → orchestrator: after green verification, Forge cleanup/report if used; then
-            state.md, evidence.md, touched-files.md (the canonical writer)
+PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
+RECORD    → orchestrator: after green verification, update state.md/evidence.md and
+            upsert the authoritative candidate manifest from the actual scoped diff
 (CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
             local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
-STOP      → report + recommend next; do not start slice N+1
+NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
 ```
 
-## Why stop after one slice
-- Keeps the diff reviewable (~one capability, roughly ≤100 lines of meaningful change).
-- Surfaces integration/drift problems while they're cheap.
-- Gives the user a decision point. They may reprioritize, reslice, or polish now.
-- Prevents the "90% done" pile-up where nothing is proven.
+## Why the boundary matters
+- Keeps diffs reviewable and reveals integration or drift early.
+- Preserves a HITL decision point and prevents unproven pile-ups.
 
 ## Restate the scope boundary
 Before coding, write what this slice will and will **not** touch. This is the contract

package/pack/generated/codex/skills/rite-build/reference/output.md

@@ -1,41 +1,31 @@
 # rite-build output
 
-This is the normative output contract for `$rite-build`. `../SKILL.md` points
-here so the root skill can stay focused without weakening response shape.
-
-Run `devrites-engine progress` first. It prints the deterministic header, slice
-meter, and flow ribbon. Put the compact fact lines below it using the shared
-completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../../devrites-lib/reference/reply-contract.md)).
-
-**Slice built; slices remain:**
+**Slices remain:**
 ```text
 Done: built slice <n> — <name>.
-Changed: <files touched>; state.md, touched-files.md, evidence.md
-Evidence: acceptance met; tests <cmd -> pass>; browser <summary | n/a>; drift <none|handled>
-Open: <none | blockers | questions>
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd->pass>; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
 Next: $rite-build
 Record: .devrites/work/<slug>/evidence.md
 ↻ Hygiene: /clear between slices; $rite-handoff if away > a few hours
 ```
 
-**Slice built; all slices built:**
+**All built:**
 ```text
 Done: built slice <n> — <name>; all slices built.
-Changed: <files touched>; state.md, touched-files.md, evidence.md
-Evidence: acceptance met; tests <cmd -> pass>; browser <summary | n/a>; drift <none|handled>
-Open: <none | blockers | questions>
+Changed: <files>; state.md, touched-files.md, evidence.md
+Evidence: acceptance met; tests <cmd->pass>; browser <summary|n/a>; drift <none|handled>
+Open: <none|blockers|questions>
 Next: $rite-prove
 Record: .devrites/work/<slug>/evidence.md
 ↻ Hygiene: /clear before $rite-prove; $rite-handoff if away > a few hours
 ```
 
-For awaiting-human or stopped states, use the typed templates from the reply contract.
-Keep fact lines terse. The meter and ribbon carry progress; don't duplicate them in
-prose.
-
-For a **forged slice**, the `Built` line names the competition and points at the record, e.g.
-`Done: built slice 3 — csv-streaming (forged: 3 candidates, winner B).` and
-`Record: .devrites/work/<slug>/forge-report.md`.
+HITL returns after one green slice. Only explicit `.devrites/AFK` lets the
+controlling root chain another pending slice after green-proof, cap, and pause
+gates. Every `devrites-slice-wright` returns after exactly one slice.
 
-**DO NOT continue to the next slice automatically**: even at `✅ ALL BUILT`, `$rite-prove` is the user's call.
+At all built, Build never enters `$rite-prove` automatically; a higher-level
+orchestrator may invoke it only under its own contract. Awaiting-human or
+stopped states use the shared reply contract.